Search: onr:"swepub:oai:research.chalmers.se:5c9034c3-c3e0-4f6e-b41d-70a644aa0e12" >
Towards Automated S...
Towards Automated Security Design Flaw Detection
-
- Sion, Laurens (author)
- Katholieke Universiteit Leuven
-
- Tuma, Katja, 1991 (author)
- Gothenburg University,Göteborgs universitet,Institutionen för data- och informationsteknik (GU),Department of Computer Science and Engineering (GU)
-
- Scandariato, Riccardo, 1975 (author)
- Gothenburg University,Göteborgs universitet,Institutionen för data- och informationsteknik (GU),Department of Computer Science and Engineering (GU)
-
show more...
-
- Yskout, Koen (author)
- Katholieke Universiteit Leuven
-
Joosen, Wouter (author)
-
show less...
-
(creator_code:org_t)
- 2019
- 2019
- English.
-
In: Proceedings - 2019 34th IEEE/ACM International Conference on Automated Software Engineering Workshops, ASEW 2019. ; , s. 49-56
- Related links:
-
https://research.cha...
-
show more...
-
https://doi.org/10.1...
-
https://research.cha...
-
https://gup.ub.gu.se...
-
show less...
Abstract
Subject headings
Close
- Efficiency of security-by-design has become an important goal for organizations implementing software engineering practices such as Agile, DevOps, and Continuous Integration. Software architectures are (often manually) analyzed at design time for potential security design flaws, based on natural language descriptions of security weaknesses (e.g., CWE, CAPEC). The use of natural language hinders the application of such knowledge bases in an automated fashion. In this paper, we analyze an existing catalog of 19 security design flaws in order to identify conceptual, technology-independent requirements on architectural models that enable automatically detecting these flaws. This constitutes the first step towards automated assessment of design-level security. Our findings are illustrated on an IoT-based smart home system.
Subject headings
- NATURVETENSKAP -- Data- och informationsvetenskap -- Programvaruteknik (hsv//swe)
- NATURAL SCIENCES -- Computer and Information Sciences -- Software Engineering (hsv//eng)
- NATURVETENSKAP -- Data- och informationsvetenskap -- Systemvetenskap, informationssystem och informatik (hsv//swe)
- NATURAL SCIENCES -- Computer and Information Sciences -- Information Systems (hsv//eng)
- TEKNIK OCH TEKNOLOGIER -- Elektroteknik och elektronik -- Datorsystem (hsv//swe)
- ENGINEERING AND TECHNOLOGY -- Electrical Engineering, Electronic Engineering, Information Engineering -- Computer Systems (hsv//eng)
Keyword
- design analysis
- Security
- design inspection
- design flaws
Publication and Content Type
- kon (subject category)
- ref (subject category)
To the university's database